Re: Hex Strings Appended to Pathnames

Richard Lynch wrote:

I don't know if it's before/after, but PHP can't change the GET request to something it wasn't... So THAT was the URL requested. You might have some kind of funky mod_rewrite rule messing you up... On Tue, January 29, 2008 5:22 am, Mick wrote:

Richard Lynch wrote:

    
On Sun, January 27, 2008 7:57 am, Mick wrote:

      
Operating System: CentOS 4.6

PHP Version: 4.3.9-3.22.9 Zend Optimizer (free) version: 3.2.6 Hello. I've got somewhat of a strange problem here involving Squirrelmail. Basically, what is happening is that one of our customers is logged out of his Squirrelmail session at random intervals. This can occur when he goes to read an email or, after composing an email, when he clicks on the Send button. The following log entries correspond with those times that the customer is logged out. [error] [client X.X.X.X] File does not exist: /var/www/squirrelmail/src/redirect.php3a5def33 [error] [client X.X.X.X] File does not exist: /var/www/squirrelmail/src/redirect.php29e09f87 [error] [client X.X.X.X] File does not exist: /var/www/squirrelmail/src/move_messages.phpf9f96dfb [error] [client X.X.X.X] File does not exist: /var/www/squirrelmail/src/redirect.phpdc6cc80a So what would be the cause of appending those hex strings to those pathnames?

You'll probably have to ask the squirrelMail guy... Unless you can reproduce it with other applications, it's not in PHP itself, probably. PS I'm a squirrelMail user, and I get logged out a lot too. :-(

Hi Richard. Thank you for your reply.

    
You'll probably have to ask the squirrelMail guy...
      
I've already asked him, and he referred me to the PHP/Zend guys i.e.

to here. ;) Actually, what the access logs show for these events is this for example: "GET /squirrelmail/src/compose.php9e99b821 HTTP/1.1" 404 "GET /squirrelmail/src/redirect.php3a5def33 HTTP/1.1" 404 Do you know if logging for the access log is performed before or after the URL is passed through to php? Cheers, Mick.

Hi Richard.

So THAT was the URL requested. As I had suspected.

You might have some kind of funky mod_rewrite rule messing you up... There is no rewrite rule. It's an extremely strange problem.

Cheers, Mick.